The version of Sendmail 8.13.1-2 on Red Hat Enterprise Linux 4 Update 4 and earlier does not reject the "localhost.localdomain" domain name for e-mail messages that come from external hosts, which might allow remote attackers to spoof messages.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0237 advisory.

    - fix verification of SSL certificate with NUL in name (#553618, CVE-2009-4565)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2007:0252 :

Updated sendmail packages that fix a security issue and various bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Sendmail is a very widely used Mail Transport Agent (MTA). MTAs deliver mail from one machine to another. Sendmail is not a client program, but rather a behind-the-scenes daemon that moves email over networks or the Internet to its final destination.

The configuration of Sendmail on Red Hat Enterprise Linux was found to not reject the 'localhost.localdomain' domain name for e-mail messages that came from external hosts. This could have allowed remote attackers to disguise spoofed messages (CVE-2006-7176).

This updated package also fixes the following bugs :

* Infinite loop within tls read.

* Incorrect path to selinuxenabled in initscript.

* Build artifacts from sendmail-cf package.

* Missing socketmap support.

* Add support for CipherList configuration directive.

* Path for aliases file.

* Failure of shutting down sm-client.

* Allows to specify persistent queue runners.

* Missing dnl for SMART_HOST define.

* Fixes connections stay in CLOSE_WAIT.

All users of Sendmail should upgrade to these updated packages, which contains backported patches to resolve these issues.

Updated sendmail packages that fix a security issue and various bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Sendmail is a very widely used Mail Transport Agent (MTA). MTAs deliver mail from one machine to another. Sendmail is not a client program, but rather a behind-the-scenes daemon that moves email over networks or the Internet to its final destination.

The configuration of Sendmail on Red Hat Enterprise Linux was found to not reject the 'localhost.localdomain' domain name for e-mail messages that came from external hosts. This could have allowed remote attackers to disguise spoofed messages (CVE-2006-7176).

This updated package also fixes the following bugs :

* Infinite loop within tls read.

* Incorrect path to selinuxenabled in initscript.

* Build artifacts from sendmail-cf package.

* Missing socketmap support.

* Add support for CipherList configuration directive.

* Path for aliases file.

* Failure of shutting down sm-client.

* Allows to specify persistent queue runners.

* Missing dnl for SMART_HOST define.

* Fixes connections stay in CLOSE_WAIT.

All users of Sendmail should upgrade to these updated packages, which contains backported patches to resolve these issues.

The configuration of sendmail in Scientific Linux was found to not reject the 'localhost.localdomain' domain name for email messages that come from external hosts. This could allow remote attackers to disguise spoofed messages. (CVE-2006-7176)

A flaw was found in the way sendmail handled NUL characters in the CommonName field of X.509 certificates. An attacker able to get a carefully-crafted certificate signed by a trusted Certificate Authority could trick sendmail into accepting it by mistake, allowing the attacker to perform a man-in-the-middle attack or bypass intended client certificate authentication. (CVE-2009-4565)

Note: The CVE-2009-4565 issue only affected configurations using TLS with certificate verification and CommonName checking enabled, which is not a typical configuration.

This update also fixes the following bugs :

  - sendmail was unable to parse files specified by the     ServiceSwitchFile option which used a colon as a     separator. (BZ#512871)

  - sendmail incorrectly returned a zero exit code when free     space was low. (BZ#299951)

  - the sendmail manual page had a blank space between the
    -qG option and parameter. (BZ#250552)

  - the comments in the sendmail.mc file specified the wrong     path to SSL certificates. (BZ#244012)

  - the sendmail packages did not provide the MTA     capability. (BZ#494408)

The configuration of Sendmail was found to not reject the 'localhost.localdomain' domain name for e-mail messages that came from external hosts. This could have allowed remote attackers to disguise spoofed messages (CVE-2006-7176).

Updated sendmail packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Sendmail is a very widely used Mail Transport Agent (MTA). MTAs deliver mail from one machine to another. Sendmail is not a client program, but rather a behind-the-scenes daemon that moves email over networks or the Internet to its final destination.

The configuration of sendmail in Red Hat Enterprise Linux was found to not reject the 'localhost.localdomain' domain name for email messages that come from external hosts. This could allow remote attackers to disguise spoofed messages. (CVE-2006-7176)

A flaw was found in the way sendmail handled NUL characters in the CommonName field of X.509 certificates. An attacker able to get a carefully-crafted certificate signed by a trusted Certificate Authority could trick sendmail into accepting it by mistake, allowing the attacker to perform a man-in-the-middle attack or bypass intended client certificate authentication. (CVE-2009-4565)

Note: The CVE-2009-4565 issue only affected configurations using TLS with certificate verification and CommonName checking enabled, which is not a typical configuration.

This update also fixes the following bugs :

* sendmail was unable to parse files specified by the ServiceSwitchFile option which used a colon as a separator.
(BZ#512871)

* sendmail incorrectly returned a zero exit code when free space was low. (BZ#299951)

* the sendmail manual page had a blank space between the -qG option and parameter. (BZ#250552)

* the comments in the sendmail.mc file specified the wrong path to SSL certificates. (BZ#244012)

* the sendmail packages did not provide the MTA capability.
(BZ#494408)

All users of sendmail are advised to upgrade to these updated packages, which resolve these issues.

ID	Name	Product	Family	Severity
181057	Oracle Linux 5 : sendmail (ELSA-2010-0237)	Nessus	Oracle Linux Local Security Checks	medium
67480	Oracle Linux 4 : sendmail (ELSA-2007-0252)	Nessus	Oracle Linux Local Security Checks	medium
67046	CentOS 4 : sendmail (CESA-2007:0252)	Nessus	CentOS Local Security Checks	medium
60774	Scientific Linux Security Update : sendmail on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60169	Scientific Linux Security Update : sendmail on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
46286	RHEL 5 : sendmail (RHSA-2010:0237)	Nessus	Red Hat Local Security Checks	high
25142	RHEL 4 : sendmail (RHSA-2007:0252)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2006-7176

high

Tenable Plugins

medium

medium

medium

high

medium

high

medium